VYPR
← All advisories
High severityNVD Advisory· Published Oct 11, 2022· Updated Nov 4, 2025

CVE-2022-37599

CVE-2022-37599

Description

A ReDoS vulnerability exists in webpack loader-utils v2.0.0 due to insufficient input sanitization in the interpolateName function, allowing attackers to cause a denial of service via crafted resourcePath strings.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A ReDoS vulnerability exists in webpack loader-utils v2.0.0 due to insufficient input sanitization in the `interpolateName` function, allowing attackers to cause a denial of service via crafted resourcePath strings.

Vulnerability

Description CVE-2022-37599 is a Regular Expression Denial of Service (ReDoS) vulnerability found in webpack loader-utils version 2.0.0 [1]. The flaw resides in the interpolateName function within interpolateName.js [4]. The root cause is that the resourcePath variable is passed into a regular expression without proper sanitization, making it susceptible to catastrophic backtracking when an attacker supplies a specially crafted string.

Exploitation

To exploit this vulnerability, an attacker must be able to control the resourcePath input that is processed by the interpolateName function [2]. This is often achievable through webpack configuration or dynamic resource loading. No authentication is required if the attacker can influence the build process or resource naming. The weakness is triggered by feeding a maliciously constructed resourcePath that contains sequences forcing the regex engine to perform excessive backtracking [1].

Impact

Successful exploitation results in a denial of service condition. The affected component can become unresponsive or consume excessive CPU resources, potentially leading to application downtime or degraded performance. As this is a ReDoS vulnerability, the primary impact is on availability, though it can also affect the development or build pipeline if the vulnerable code is invoked during compilation.

Mitigation

The vulnerability is specific to loader-utils version 2.0.0. The repository has been archived and is now read-only [3]. Users should upgrade to a patched version or migrate to alternative loaders. No workaround is provided. The CVE has been published and acknowledged in the National Vulnerability Database [1].

References
  1. NVD - CVE-2022-37599
  2. GitHub - webpack/loader-utils: utils for webpack loaders
  3. loader-utils/lib/interpolateName.js at d9f4e23cf411d8556f8bac2d3bf05a6e0103b568 · webpack/loader-utils
  4. loader-utils/lib/interpolateName.js at d9f4e23cf411d8556f8bac2d3bf05a6e0103b568 · webpack/loader-utils

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
loader-utilsnpm
>= 1.0.0, < 1.4.21.4.2
loader-utilsnpm
>= 2.0.0, < 2.0.42.0.4
loader-utilsnpm
>= 3.0.0, < 3.2.13.2.1

Affected products

2

Patches

3
17cbf8fa8989

fix: ReDoS problem (#226)

https://github.com/webpack/loader-utilsAlexander AkaitNov 11, 2022via ghsa
commit
1 file changed · +1 −1
  • lib/interpolateName.js+1 −1 modified
    @@ -108,7 +108,7 @@ function interpolateName(loaderContext, name, options) {
       // `hash` and `contenthash` are same in `loader-utils` context
       // let's keep `hash` for backward compatibility
       .replace(
-        /\[(?:([^:\]]+):)?(?:hash|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,
+        /\[(?:([^[:\]]+):)?(?:hash|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,
         (all, hashType, digestType, maxLength) =>
           getHashDigest(content, hashType, digestType, parseInt(maxLength, 10))
       )
ac09944dfacd

fix: ReDoS problem (#225)

https://github.com/webpack/loader-utilsAlexander AkaitNov 11, 2022via ghsa
commit
1 file changed · +1 −1
  • lib/interpolateName.js+1 −1 modified
    @@ -108,7 +108,7 @@ function interpolateName(loaderContext, name, options) {
       // `hash` and `contenthash` are same in `loader-utils` context
       // let's keep `hash` for backward compatibility
       .replace(
-        /\[(?:([^:\]]+):)?(?:hash|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,
+        /\[(?:([^[:\]]+):)?(?:hash|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,
         (all, hashType, digestType, maxLength) =>
           getHashDigest(content, hashType, digestType, parseInt(maxLength, 10))
       )
d2d752d59629

fix: ReDoS problem (#224)

https://github.com/webpack/loader-utilsAlexander AkaitNov 11, 2022via ghsa
commit
2 files changed · +991 −897
  • lib/interpolateName.js+1 −1 modified
    @@ -76,7 +76,7 @@ function interpolateName(loaderContext, name, options = {}) {
       // `hash` and `contenthash` are same in `loader-utils` context
       // let's keep `hash` for backward compatibility
       .replace(
-        /\[(?:([^:\]]+):)?(?:hash|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,
+        /\[(?:([^[:\]]+):)?(?:hash|contenthash)(?::([a-z]+\d*))?(?::(\d+))?\]/gi,
         (all, hashType, digestType, maxLength) =>
           getHashDigest(content, hashType, digestType, parseInt(maxLength, 10))
       );
  • yarn.lock+990 −896 modified

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.